h-dv/code-index
3
0
Fork 0
Code Issues Pull requests Projects Releases 13 Packages Wiki Activity Actions
13 releases 14 tags
  • v0.4.1 5669573a04

    v0.4.1
    Some checks failed
    CI / cargo fmt (pull_request) Failing after 15s
    Details
    CI / cargo clippy (pull_request) Has been skipped
    Details
    CI / cargo test (pull_request) Has been skipped
    Details
    CI / cargo fmt (push) Failing after 16s
    Details
    CI / cargo clippy (push) Has been skipped
    Details
    CI / cargo test (push) Has been skipped
    Details
    Release Build / Generate Version (push) Successful in 15s
    Details
    Release Build / Build linux-x86_64 (push) Successful in 3m54s
    Details
    Release Build / Build linux-aarch64 (push) Successful in 4m18s
    Details
    Release Build / Build windows-x86_64 (push) Successful in 4m39s
    Details
    Release Build / Create Forgejo Release (push) Failing after 1m1s
    Details
    Stable

    buildagent released this 2026-06-04 15:41:06 +02:00 | 18 commits to master since this release

    Security hardening

    Completes the parser recursion-depth hardening started in v0.4.0.

    v0.4.0 capped every plugin's walk recursion, but the self-recursive type-expression helpers in the Python, C#, and TypeScript plugins were still unbounded. A crafted file with a deeply nested type expression (List[List[...]], List<List<...>>, Array<Array<...>>) is reached via a shallow walk but recurses thousands of levels inside emit_type_ref / emit_receiver_type_refs, overflowing the daemon's worker stack — which catch_unwind cannot intercept.

    Each helper now routes through a depth-aware core guarded by MAX_PARSE_DEPTH. Extraction behavior is unchanged; a deep-nested-type regression test per plugin confirms the guard (verified to SIGABRT with the cap disabled). PHP's type helper is structurally flat and needs no guard.

    With this, all six language parsers are fully guarded against the deeply-nested-input stack-overflow DoS — closing the last residual from the v0.4.0 ultradeep review.

    Changes: v0.4.0...v0.4.1

    Downloads